This advisory announces multiple security vulnerabilities that
were found in Jenkins core.

One of the vulnerabilities allows cross-site request
forgery (CSRF) attacks on Jenkins master, which causes an user
to make unwanted actions on Jenkins. Another vulnerability
enables cross-site scripting (XSS) attacks, which has the similar
consequence. Another vulnerability allowed an attacker to bypass
the CSRF protection mechanism in place, thereby mounting more CSRF
attackes. These attacks allow an attacker without direct access to
Jenkins to mount an attack.

In the fourth vulnerability, a malicious user of Jenkins can trick
Jenkins into building jobs that he does not have direct access to.

And lastly, a vulnerability allows a malicious user of Jenkins to
mount a denial of service attack by feeding a carefully crafted
payload to Jenkins.

This advisory announces security vulnerabilities that were found
in Jenkins core and several plugins.

The first vulnerability in Jenkins core allows unprivileged
users to insert data into Jenkins master, which can lead to
remote code execution. For this vulnerability to be exploited,
the attacker must have an HTTP access to a Jenkins master, and
he must have a read access to Jenkins.

The second vulnerability in Jenkins core is a cross-site
scripting vulnerability. This allows an attacker to craft an URL
that points to Jenkins, and if a legitimate user clicks this link,
and the attacker will be able to hijack the user session.

The third vulnerability is a cross-site scripting vulnerability
in the Violations plugin

The fourth vulnerability is a cross-site scripting vulnerability
in The Continuous Integration Game plugin

An XSS vulnerability was found in Jenkins core, which allows an
attacker to inject malicious HTMLs to pages served by Jenkins.
This allows an attacker to escalate his privileges by hijacking
sessions of other users. This vulnerability affects all
versions.

An XSS vulnerability was found in Jenkins core, which allows an
attacker to inject malicious HTMLs to pages served by Jenkins.
This allows an attacker to escalate his privileges by hijacking
sessions of other users. This vulnerability affects all
versions.

This advisory announces multiple security vulnerabilities that
were found in Jenkins core.

SECURITY-63 / CVE-2013-2034

This creates a cross-site request forgery (CSRF) vulnerability
on Jenkins master, where an anonymous attacker can trick an
administrator to execute arbitrary code on Jenkins master by
having him open a specifically crafted attack URL.

There's also a related vulnerability where the permission
check on this ability is done imprecisely, which may affect
those who are running Jenkins instances with a custom
authorization strategy plugin.

SECURITY-67 / CVE-2013-2033

This creates a cross-site scripting (XSS) vulnerability, where
an attacker with a valid user account on Jenkins can execute
JavaScript in the browser of other users, if those users are
using certain browsers.

SECURITY-69 / CVE-2013-2034

This is another CSRF vulnerability that allows an attacker to
cause a deployment of binaries to Maven repositories. This
vulnerability has the same CVE ID as SEUCRITY-63.